What Is a Key Person Under CySEC?
The Cyprus Securities and Exchange Commission (CySEC) supervises investment firms, fund managers and crypto-asset service providers in Cyprus. A key person is an individual who directs the business or runs one of its key control functions. CySEC assesses these people before they take up their roles, and the firm remains responsible for making sure they stay suitable.
Most of our CySEC work is for Cyprus Investment Firms (CIFs), which are authorised under the Investment Services and Activities and Regulated Markets Law of 2017 (Law 87(I)/2017), the Cyprus law that implements MiFID II. This guide focuses on CIFs, but the same principles apply to other CySEC regulated entities.
Persons Who Effectively Direct the Business
Under MiFID II, the business of an investment firm must be effectively directed by at least two persons who meet the suitability requirements. This is often called the "four eyes" principle. In a CIF, these are usually two executive directors.
These people, and the rest of the board, are assessed for:
- Good repute, honesty and integrity, including regulatory and criminal history
- Knowledge, skills and experience relevant to the firm's services
- Sufficient time to perform their duties
- Independence of mind, so they can challenge decisions effectively
CySEC applies the European joint guidelines on the suitability of members of the management body and key function holders when it carries out these assessments.
Key Functions in a Cyprus Investment Firm
Beyond the directors, a CIF needs people running its key control functions. The functions we are asked to fill most often are:
| Function | Role |
|---|---|
| Compliance Officer | Monitors compliance with regulatory obligations and advises the board |
| Risk Manager | Runs the risk management framework |
| Internal Auditor | Provides independent assurance; this function is often outsourced |
| AML Compliance Officer (AMLCO) | Runs anti-money laundering controls under the Prevention and Suppression of Money Laundering and Terrorist Financing Law (Law 188(I)/2007) |
Depending on the size and complexity of the firm, some functions may be combined or outsourced, but the firm stays responsible for them. Your licensing adviser will confirm what is acceptable for your business model.
CySEC Certification of Professional Competence
CySEC runs its own certification examinations, and certified individuals are listed in CySEC's public register of certified persons. There are three main certificates:
- Basic certificate, for roles such as reception and transmission of orders
- Advanced certificate, for more senior roles, including investment advice and many compliance roles
- AML certificate, for anti-money laundering roles, including the AMLCO
Certified persons must complete continuing professional development every year to keep their certification. Check which certificate CySEC requires for each function in your firm before you advertise the role, because it narrows the candidate pool considerably.
Substance in Cyprus
CySEC expects a CIF to be effectively directed from Cyprus. In practice, this means executive directors and key function holders are generally expected to work from Cyprus, not to oversee the business remotely. This is one of the main differences from regimes such as the FSCA in South Africa, where remote Key Individual arrangements are more common.
Limassol is the centre of the Cyprus investment firm industry, and most experienced candidates are based there or are willing to relocate.
How to Hire CySEC Key Persons
The candidates who are easiest to get approved are those with prior CySEC approval history and the right certificate already in place. A few practical points:
- Check certification first. Confirm that a candidate's certificate is current and that they appear on CySEC's public register.
- Screen for suitability before the regulator does. Verify regulatory history, references and relevant experience early.
- Be realistic about combined roles. One person covering compliance and AML is common in smaller firms, but they need to be credible in both.
- Plan for relocation. If your preferred candidate is outside Cyprus, factor in relocation and work permit time.
For more detail, see our compliance officer job description for CySEC regulated firms, how long it takes to hire an MLRO and the CySEC key individual requirements guide.
Browse Cyprus and Compliance Vacancies
Work With HRFinEase
Are you a certified compliance, risk or AML professional? Submit your CV and we will contact you when a matching role opens.
Need a key person for a CySEC licence or an existing CIF? Hire talent through HRFinEase. We check certification and regulatory history before you meet a candidate.
Key Individual Guides for Other Jurisdictions
- Key Individual requirements for FSCA licensed firms in South Africa
- Key Individual and responsible person requirements in the UAE (SCA and VARA)
- Fintech recruitment in Cyprus: complete guide for companies
Frequently Asked Questions
How many directors does a Cyprus Investment Firm need? Under MiFID II, the business must be effectively directed by at least two persons who meet the suitability requirements. In a CIF, these are usually two executive directors.
Which CySEC certificate does a compliance officer need? Many compliance roles require the CySEC Advanced certificate, and AML roles require the AML certificate. Check CySEC's current requirements for the specific function before you hire.
Can a CySEC key person work remotely? CySEC expects a CIF to be effectively directed from Cyprus, so executive directors and key function holders are generally expected to work from Cyprus.
Can the internal audit function be outsourced? Internal audit is commonly outsourced to a specialist firm, but the CIF remains responsible for the function and must oversee the provider.
Can HRFinEase help find CySEC key persons? Yes. We recruit executive directors, compliance officers, risk managers and AMLCOs for CySEC regulated firms. Brief us on your role or register your CV.
Summary of published rules and practitioner experience as of November 2026. Requirements change, so confirm with CySEC and your licensing adviser before making appointments.